← Vulnerability feed

Vulnerability record · CVE-2023-22602 · published 14 January 2023

CVE-2023-22602: Apache shiro interpretation conflict vulnerability

Apache · Shiro

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

7.5 CVSS 3.1 High EPSS 1.6% · top 25.8% CWE-436 · Interpretation conflict
7.5CVSS 3.1 base score
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl Mailing ListVendor Advisory
https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl Mailing ListVendor Advisory
https://security.netapp.com/advisory/ntap-20230302-0001/

Track CVE-2023-22602 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-4437Apache Shiro hardcoded remember-me cipher key enables code executionApache Shiro before 1.2.5 uses a default cipher key for the "remember me" feature when no key is configured, allowing attackers to forge or decrypt r…KEVEPSS 93%analysed9.8CVE-2026-40974Vmware spring boot improper certificate validation vulnerabilitySpring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring …EPSS 0.36%9.8CVE-2023-34478Apache shiro path traversal vulnerabilityApache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used togeth…EPSS 2.1%9.8CVE-2023-20873Vmware spring boot vulnerabilityIn Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susc…EPSS 1.1%9.8CVE-2022-40664Apache shiro improper authentication vulnerabilityApache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.EPSS 2.7%9.8CVE-2022-32532Apache shiro incorrect authorization vulnerabilityApache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatch…EPSS 26%9.8CVE-2021-41303Apache Shiro with Spring Boot authentication bypass via crafted HTTP requestApache Shiro before 1.8.0, when used with Spring Boot, can be tricked by a specially crafted HTTP request into bypassing authentication. The flaw is …EPSS 77%analysed9.8CVE-2021-26987Vmware spring boot vulnerabilityElement Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability…EPSS 2.4%

Source: NIST National Vulnerability Database (record CVE-2023-22602), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.